CVE-2021-47375

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> blktrace: Fix uaf in blk_trace access after removing by sysfs<br /> <br /> There is an use-after-free problem triggered by following process:<br /> <br /> P1(sda) P2(sdb)<br /> echo 0 &gt; /sys/block/sdb/trace/enable<br /> blk_trace_remove_queue<br /> synchronize_rcu<br /> blk_trace_free<br /> relay_close<br /> rcu_read_lock<br /> __blk_add_trace<br /> trace_note_tsk<br /> (Iterate running_trace_list)<br /> relay_close_buf<br /> relay_destroy_buf<br /> kfree(buf)<br /> trace_note(sdb&amp;#39;s bt)<br /> relay_reserve<br /> buf-&gt;offset /sys/block/sdb/trace/enable &amp;<br /> // Add delay(mdelay/msleep) before kernel enters blk_trace_free()<br /> <br /> ioctl$SG_IO(/dev/sda, SG_IO, ...)<br /> // Enters trace_note_tsk() after blk_trace_free() returned<br /> // Use mdelay in rcu region rather than msleep(which may schedule out)<br /> <br /> Remove blk_trace from running_list before calling blk_trace_free() by<br /> sysfs if blk_trace is at Blktrace_running state.